Hub Protocol: Add API contracts, federation, and security protocols by Copilot · Pull Request #469 · objectstack-ai/framework

Copilot · 2026-02-02T01:23:16Z

The Hub protocol lacked REST API contracts, multi-region federation support, and plugin security infrastructure. This adds complete specifications for managing tenants, plugins, and workspaces at scale.

Changes

API Contracts (`api/hub.zod.ts` - 960 lines)

Complete HTTP API specifications with request/response schemas:

Space Management: CRUD + pagination/filtering/sorting
Tenant Management: Multi-tenancy with isolation levels
Plugin Registry: Publishing, versioning, search
License Management: Issuance, validation, revocation
Composer Service: BOM compilation, build status
Health Monitoring: System metrics, service status

// Example: Create space with runtime quotas
const request: CreateSpaceRequest = {
  name: 'Sales Team',
  slug: 'sales-team',
  ownerId: 'user_123',
  runtime: {
    isolation: 'shared_schema',
    quotas: { maxUsers: 50, maxStorage: 107374182400, apiRateLimit: 10000 }
  }
};

Federation Protocol (`hub/hub-federation.zod.ts` - 500 lines)

Multi-region deployment infrastructure:

Region Modeling: Geographic regions with compliance metadata (GDPR, HIPAA, SOC2)
Hub Instances: Primary/Secondary/Edge roles with replication configs
Tenant Placement: Data residency policies with continent/region restrictions
Replication Jobs: Cross-region sync with conflict resolution strategies
Edge Locations: CDN integration for plugin/asset distribution

// Example: EU data residency compliance
const placement: TenantPlacementPolicy = {
  tenantId: 'tenant_eu',
  primaryRegion: 'eu-west-1',
  dataResidency: {
    continent: 'EU',
    prohibitedRegions: ['us-east-1'] // No US data
  }
};

Security Protocol (`hub/plugin-security.zod.ts` - 650 lines)

Supply chain security and dependency management:

Vulnerability Scanning: CVE/GHSA tracking with severity classification
Dependency Resolution: Semantic versioning with conflict detection + topological sorting
SBOM: CycloneDX/SPDX format with hash verification
Provenance: Build environment, source verification, digital signatures
Trust Scoring: Multi-dimensional metrics (vendor reputation, security, code quality, community engagement)

// Example: Security scan with zero vulnerabilities
const scan: SecurityScanResult = {
  plugin: { id: 'com.acme.crm', version: '2.0.0' },
  status: 'passed',
  summary: { critical: 0, high: 0, medium: 0, low: 0 }
};

// Trust scoring
const trust: PluginTrustScore = {
  score: 88,
  components: { vendorReputation: 95, securityScore: 90, codeQuality: 85 },
  level: 'trusted',
  badges: ['verified-vendor', 'security-scanned', 'code-signed']
};

Test Coverage

30 new tests across 3 test files
All 3,013 tests passing
100% Zod runtime validation + TypeScript type safety

Documentation

hub-management-example.ts: 900+ lines of working examples
HUB_PROTOCOL_DEVELOPMENT_PLAN.md: Implementation roadmap (bilingual)
HUB_PROTOCOL_SUMMARY.md: Executive summary (bilingual)

Original prompt

扫描SPEC中的hub协议，作为objectstack所有租户，插件的统一的云端管理中心，提出具体的改进方案和实开发计划

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

vercel · 2026-02-02T01:23:20Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
spec	Ready	Preview, Comment	Feb 2, 2026 3:18am

Co-authored-by: hotlong <50353452+hotlong@users.noreply.github.com>

+import {
+  // Space Management
+  CreateSpaceRequest,
+  SpaceResponse,
+  ListSpacesResponse,
+
+  // Tenant Management
+  CreateTenantRequest,
+  TenantResponse,
+
+  // Plugin Registry
+  PublishPluginRequest,
+  PluginResponse,
+  SearchPluginsResponse,
+
+  // License Management
+  IssueLicenseRequest,
+  LicenseResponse,
+  ValidateLicenseResponse,
+
+  // Composer Service
+  CompileManifestRequest,
+  CompileManifestResponse,
+
+  // Health & Monitoring
+  HubHealthResponse,
+  HubMetricsResponse,
+} from '@objectstack/spec/api';


To fix unused imports, remove only the specific identifiers that are not referenced anywhere in the file, leaving the rest of the import structure intact. This avoids any behavior changes while cleaning up the code.

Concretely, in examples/basic/hub-management-example.ts, adjust the @objectstack/spec/api import block: delete CreateTenantRequest, TenantResponse, and PluginResponse from the named import list, keeping formatting and comments for other sections the same. No additional methods, definitions, or imports are required.

+import {
+  // Federation
+  Region,
+  FederationTopology,
+  TenantPlacementPolicy,
+
+  // Security
+  SecurityScanResult,
+  SecurityPolicy,
+  DependencyResolutionResult,
+  SBOM,
+  PluginProvenance,
+  PluginTrustScore,
+} from '@objectstack/spec/hub';


In general, to fix an unused import, remove it from the import list (or add code that actually uses it, if it was intended to be used). This keeps the codebase clean and avoids misleading readers about required dependencies.

For this specific file, the best fix without changing functionality is to remove Region from the import list from @objectstack/spec/hub on lines 47–58. No other code changes are needed, as the unused symbol is not referenced elsewhere in the shown snippet. Concretely, in examples/basic/hub-management-example.ts, edit the import block starting at line 45 so that the comment // Federation is followed directly by FederationTopology and TenantPlacementPolicy, omitting Region. No additional methods, imports, or definitions are required.

Copilot

Pull request overview

This pull request adds comprehensive Hub protocol enhancements to ObjectStack, introducing API contracts, multi-region federation, and plugin security infrastructure for managing tenants, plugins, and workspaces at scale.

Changes:

Complete REST API specifications for Hub management operations (spaces, tenants, plugins, licenses, composer, health monitoring)
Multi-region federation protocol supporting global deployments with data residency compliance (GDPR, HIPAA, SOC2)
Plugin security and supply chain protocols including vulnerability scanning, dependency resolution, SBOM generation, provenance tracking, and trust scoring

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
packages/spec/src/api/hub.zod.ts	Comprehensive Hub API contracts with request/response schemas for all management operations
packages/spec/src/api/hub.test.ts	Test coverage for Hub API protocols
packages/spec/src/api/index.ts	Export Hub API protocols
packages/spec/src/hub/hub-federation.zod.ts	Multi-region federation protocol with regions, hub instances, tenant placement policies, and replication
packages/spec/src/hub/hub-federation.test.ts	Test coverage for federation protocol
packages/spec/src/hub/plugin-security.zod.ts	Plugin security protocol with vulnerability scanning, dependency resolution, SBOM, provenance, and trust scoring
packages/spec/src/hub/plugin-security.test.ts	Test coverage for security protocol
packages/spec/src/hub/index.ts	Export enhanced Hub protocols
examples/basic/hub-management-example.ts	Comprehensive examples demonstrating Hub protocol usage
HUB_PROTOCOL_SUMMARY.md	Executive summary and documentation of Hub protocol enhancements
HUB_PROTOCOL_DEVELOPMENT_PLAN.md	Detailed development plan and implementation roadmap

Copilot · 2026-02-02T01:56:29Z

+export const HubMetricsResponseSchema = z.object({
+  metrics: z.object({
+    spaces: z.object({
+      total: z.number().int(),
+      active: z.number().int(),
+      created_last_30d: z.number().int().optional(),
+    }).optional(),
+    tenants: z.object({
+      total: z.number().int(),
+      active: z.number().int(),
+    }).optional(),
+    plugins: z.object({
+      total: z.number().int(),
+      published_last_30d: z.number().int().optional(),
+      total_downloads: z.number().int().optional(),
+    }).optional(),
+    api: z.object({
+      requests_per_minute: z.number(),
+      avg_response_time: z.number().describe('Milliseconds'),
+      error_rate: z.number().min(0).max(1),
+    }).optional(),
+  }),
+  timestamp: z.string().datetime(),
+});


Schema property names should use camelCase according to the coding guidelines. The following properties use snake_case instead:

created_last_30d should be createdLast30d

published_last_30d should be publishedLast30d

total_downloads should be totalDownloads

requests_per_minute should be requestsPerMinute

avg_response_time should be avgResponseTime

error_rate should be errorRate

The coding guideline states: "Configuration Keys (TS Props): camelCase (e.g., maxLength, referenceFilters)" while "Machine Names (Data Values): snake_case (e.g., name: 'first_name', object: 'project_task')". These are configuration keys in a TypeScript schema, not machine name data values.

Copilot · 2026-02-02T01:56:29Z

+export const hubMetricsExample: HubMetricsResponse = {
+  metrics: {
+    spaces: {
+      total: 2450,
+      active: 1980,
+      created_last_30d: 125,
+    },
+    tenants: {
+      total: 580,
+      active: 485,
+    },
+    plugins: {
+      total: 342,
+      published_last_30d: 18,
+      total_downloads: 1245678,
+    },
+    api: {
+      requests_per_minute: 1250,
+      avg_response_time: 85,
+      error_rate: 0.0012,
+    },
+  },
+  timestamp: '2024-01-15T12:00:00Z',
+};


Example property names should use camelCase to match the schema. The following properties use snake_case instead:

created_last_30d should be createdLast30d

published_last_30d should be publishedLast30d

total_downloads should be totalDownloads

requests_per_minute should be requestsPerMinute

avg_response_time should be avgResponseTime

error_rate should be errorRate

The coding guideline states: "Configuration Keys (TS Props): camelCase (e.g., maxLength, referenceFilters)"

Copilot · 2026-02-02T01:56:30Z

+    it('should validate HubMetricsResponse', () => {
+      const validResponse = {
+        metrics: {
+          spaces: {
+            total: 1250,
+            active: 980,
+            created_last_30d: 45,
+          },
+          tenants: {
+            total: 320,
+            active: 285,
+          },
+          plugins: {
+            total: 156,
+            published_last_30d: 8,
+            total_downloads: 456789,
+          },
+          api: {
+            requests_per_minute: 850,
+            avg_response_time: 125,
+            error_rate: 0.002,
+          },
+        },
+        timestamp: '2024-01-01T12:00:00Z',
+      };


Test data property names should use camelCase to match the schema. The following properties use snake_case instead:

created_last_30d should be createdLast30d

published_last_30d should be publishedLast30d

total_downloads should be totalDownloads

requests_per_minute should be requestsPerMinute

avg_response_time should be avgResponseTime

error_rate should be errorRate

The coding guideline states: "Configuration Keys (TS Props): camelCase (e.g., maxLength, referenceFilters)"

Copilot · 2026-02-02T01:56:30Z

+import {
+  // Space Management
+  CreateSpaceRequest,
+  SpaceResponse,
+  ListSpacesResponse,
+
+  // Tenant Management
+  CreateTenantRequest,
+  TenantResponse,
+
+  // Plugin Registry
+  PublishPluginRequest,
+  PluginResponse,
+  SearchPluginsResponse,
+
+  // License Management
+  IssueLicenseRequest,
+  LicenseResponse,
+  ValidateLicenseResponse,
+
+  // Composer Service
+  CompileManifestRequest,
+  CompileManifestResponse,
+
+  // Health & Monitoring
+  HubHealthResponse,
+  HubMetricsResponse,
+} from '@objectstack/spec/api';


Unused imports CreateTenantRequest, PluginResponse, TenantResponse.

Copilot · 2026-02-02T01:56:30Z

+import {
+  // Federation
+  Region,
+  FederationTopology,
+  TenantPlacementPolicy,
+
+  // Security
+  SecurityScanResult,
+  SecurityPolicy,
+  DependencyResolutionResult,
+  SBOM,
+  PluginProvenance,
+  PluginTrustScore,
+} from '@objectstack/spec/hub';


Unused import Region.

- Add missing TestSuite type export in testing.zod.ts - Prefix unused context parameters with underscore to satisfy TS6133 - All packages now compile successfully Co-authored-by: hotlong <50353452+hotlong@users.noreply.github.com>

…ng-bug

Initial plan

a371226

Copilot AI assigned Copilot and hotlong Feb 2, 2026

Copilot started work on behalf of hotlong February 2, 2026 01:26 View session

Copilot AI and others added 3 commits February 2, 2026 01:32

Add Hub API contracts and enhanced protocols (federation, security)

3cc3000

Co-authored-by: hotlong <50353452+hotlong@users.noreply.github.com>

Add comprehensive examples and development plan documentation

c5f2b39

Co-authored-by: hotlong <50353452+hotlong@users.noreply.github.com>

Add bilingual summary document for Hub protocol improvements

93f7de1

Co-authored-by: hotlong <50353452+hotlong@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Propose enhancements for hub protocol management~~ Hub Protocol: Add API contracts, federation, and security protocols Feb 2, 2026

Copilot AI requested a review from hotlong February 2, 2026 01:42

Copilot finished work on behalf of hotlong February 2, 2026 01:42

vercel Bot deployed to Preview February 2, 2026 01:43 View deployment

hotlong marked this pull request as ready for review February 2, 2026 01:50

Copilot AI review requested due to automatic review settings February 2, 2026 01:50

github-actions Bot added documentation Improvements or additions to documentation tests size/xl labels Feb 2, 2026

Copilot started reviewing on behalf of hotlong February 2, 2026 01:51 View session

github-advanced-security AI found potential problems Feb 2, 2026

View reviewed changes

Initial plan

f32952e

Copilot AI reviewed Feb 2, 2026

View reviewed changes

Copilot AI and others added 2 commits February 2, 2026 01:58

Fix TypeScript compilation errors in QA module

861ac6e

- Add missing TestSuite type export in testing.zod.ts - Prefix unused context parameters with underscore to satisfy TS6133 - All packages now compile successfully Co-authored-by: hotlong <50353452+hotlong@users.noreply.github.com>

Merge pull request #470 from objectstack-ai/copilot/fix-data-processi…

73ffbb1

…ng-bug

vercel Bot deployed to Preview February 2, 2026 03:18 View deployment

hotlong merged commit 2541e70 into main Feb 2, 2026
10 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Hub Protocol: Add API contracts, federation, and security protocols#469

Hub Protocol: Add API contracts, federation, and security protocols#469
hotlong merged 7 commits into
mainfrom
copilot/improve-hub-protocol-management

Copilot AI commented Feb 2, 2026 •

edited

Loading

Uh oh!

vercel Bot commented Feb 2, 2026 •

edited

Loading

Uh oh!

Check notice

Copilot Autofix

Check notice

Copilot Autofix

Copilot AI left a comment

Uh oh!

Copilot AI Feb 2, 2026

Uh oh!

Copilot AI Feb 2, 2026

Uh oh!

Copilot AI Feb 2, 2026

Uh oh!

Copilot AI Feb 2, 2026

Uh oh!

Copilot AI Feb 2, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

Copilot AI commented Feb 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

API Contracts (api/hub.zod.ts - 960 lines)

Federation Protocol (hub/hub-federation.zod.ts - 500 lines)

Security Protocol (hub/plugin-security.zod.ts - 650 lines)

Test Coverage

Documentation

Uh oh!

vercel Bot commented Feb 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Check notice

Copilot Autofix

Check notice

Copilot Autofix

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Feb 2, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 2, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 2, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 2, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 2, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Copilot AI commented Feb 2, 2026 •

edited

Loading

API Contracts (`api/hub.zod.ts` - 960 lines)

Federation Protocol (`hub/hub-federation.zod.ts` - 500 lines)

Security Protocol (`hub/plugin-security.zod.ts` - 650 lines)

vercel Bot commented Feb 2, 2026 •

edited

Loading